I've been made aware of the Zend Framework 1 Security Vulnerability.

I understand that an attack could happen and so I wanted to be secure.

We don't send mails directly from our magento server, we use Sendgrid integration.

Are we safe if we are not sending the mails directly?

Many thanks in advance.

  • Is Sendgrid using ZF?
    – Marius
    Commented Jan 16, 2017 at 15:43

2 Answers 2


As stated on the Magento Security Center, you should disable the function in any case as long as there is no available fix.

See: https://magento.com/security/news/new-zend-framework-1-security-vulnerability

  • Thanks, you are right. It does say to do this regardless of which email service being used. So I will do this as per magento's instruction.
    – BlamesJunt
    Commented Jan 16, 2017 at 15:58

You should talk to Sendgrid.

If you are using this module: https://github.com/yukoff/magento2-sendgrid-smtp, you still may be voulnerable. Looking at https://github.com/yukoff/magento2-sendgrid-smtp/blob/master/Model/Transport.php it looks like their module is leveraging the Magento native send() method which may be leveraging Sendmail if your system is using Sendmail.

 * Send mail using this transport
 * @return void
 * @throws \Magento\Framework\Exception\MailException
public function sendMessage()
    try {
    } catch (\Exception $e) {
        throw new \Magento\Framework\Exception\MailException(new \Magento\Framework\Phrase($e->getMessage()), $e);

So, to be safe, you should set "Set Return_Path" to No as directed by Magento.

  • Thank you for your more expansive answer. I could contact sendgrid, but I suspect their answer will not be conclusive and so I am going to play it safe and do as Magento suggest until this problem is patched.
    – BlamesJunt
    Commented Jan 16, 2017 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.